Possible security issue with Plume CMS 1.2.3

[Titoo]

Hello,

# Executive report

Maybe a security flaw, but nothing to back up the claim. Please do a
backup of your database and your xmedia folders in case of. We will
keep
you informed.

# Long report

This morning a user reported a possible security issue with Plume CMS
1.2.3. The problem is that the affected website is running on a shared
host and the provider did not agree to provide information to really
know if the security issue they encountered was having its root in
Plume
CMS or another script/component on the server.

I have performed an extensive check on the Plume CMS source code and
was
not able to find security flaws. I have also performed an extensive
log
check on several systems running Plume CMS 1.2.3 and was not able to
find an attack affecting those installations.

This means that I am surprised and invite you to perform the following
steps:

- Full backup of your MySQL database on a regular basis.
- Full backup of your xmedia folders on a regular basis.
- Take a look in your access logs/statistics to see if you see odd
behaviours.

With that, you are fully protected for the worse case scenario, this
is
anyway always a good thing to do.

I will keep you informed,
loïc

[Titoo]

Small update.

I directly contacted the service provider of the affected user by
phone. The technical support team did not agree to provide further
details on the ground that I am not a customer. I was just asking for
one anonymous request line in their logs showing how Plume CMS was
called to trigger the security issue they clame they have seen. I am a
bit annoyed, the affected user will I hope ask this question directly.
I am still skeptic.

Do not worry, make a backup, we take care of you!

loïc

[Titoo]

Hello,

happy to inform you that the issue is fixed (as we found no security
issues). The hosting provider did not reply to repeated inquiries and
did not back up his claim. I *suppose* they mismanaged something on
their side and basically found "something/someone else" to cover
themselves.

As they were extremely unhelpful both for me as a developer and for
the poor user using their services, I recommend you to stay away from
http://www.celeonet.fr/ in the future.

Anyway, do not forget to backup your data! This is always a good thing
to do.

loïc